Post-Quantum Cryptography and India’s Digital Public Infrastructure - HackerNoon

Imagine going to bed one night and waking up the next morning to find that the cryptographic security of every Aadhaar verification, every UPI transaction, and every DigiLocker upload is now potentially breachable by machines that have not been built yet but are on their way. This is the challenge that is being posed to India’s Digital Public Infrastructure. The difference it makes to you is real-time. It is not some distant hypothetical. It is an attack on the very layer of cryptographic security which enables the operations of a billion net-consumers who depend on it for subsidies, banking, vaccination drives, land records, and identity.[1] Some years back, at a data center in Delhi, overhearing engineers discuss crypto-agility around a system that performed millions of biometric authentications every day was humbling. Going through the process of authentication, RSA signatures, the certificates, the HSMs- when one of the engineers mused out loud about the implications of a quantum computer being built that could run Shor’s algorithm at scale, the room went silent. It is not the whitepapers on post-quantum cryptography that make us realize the looming threat. It is the very system that has enabled the financial inclusion of millions and made Aadhaar a cornerstone of India’s digital transformation that is now threatened by mathematics that quantum computers will break. The Problem of Scale Is Quite Special While for many nations it is a challenge to transition a dozen systems, for India it is a system of 1.4 billion. Every single authentication that happens through the Aadhaar framework and every single transaction on UPI uses classical cryptography. “Harvest Now, Decrypt Later” is the ticking clock where encrypted data and biometric templates can be stored for later decryption. If your data has a long shelf-life, whether it is identity, health, financial, or anything else, the quantum clock is already ticking. As per the timelines published by the Department of Science and Technology Task Force, part of the National Quantum Mission of India, here is how it will unfold: foundation of critical information infrastructure – 2027, migration – 2028, post-quantum readiness of the systems – 2029, enterprises – 2033.[2] Engineering Blueprints For A Seamless Transition What would be the engineering blueprints for such a transition? For starters, hybrid cryptography is a must. Classical cryptography and the new algorithms from NIST’s post-quantum cryptography suite (ML-KEM for key encapsulation and ML-DSA for signatures) will need to co-exist for some time till performance, interoperability, and certificate chains are resolved. Second, crypto-agility for PKI and HSM upgrades. Every relying party, every authentication service, every mobile SDK needs to be able to transition to new algorithms without changing business processes. Third, it will require prioritization. The systems running the Aadhaar infrastructure, including the Unique Identification Authority of India and the National Payments Corporation of India, and those holding sensitive biometric templates and durable keys cannot wait for enterprise-grade crypto-agility solutions. Fourth, testing and certifications. TEC, STQC, and the national labs need to begin testing libraries and HSMs in real-world settings.[3]Performance at scale matters. Post-quantum cryptography algorithms based on lattice cryptography will be more memory-intensive and slower than RSA-2048 and ECC. The impact on feature phones with minimal memory, authentication systems in rural India with limited power supply, and the associated costs are real implementation challenges. Early pilots will be critical to establish performance benchmarks.[4] Challenging The Complacent Narrative The complacent narrative within the industry will need to change. The industry’s comfort with upgrading cryptographic primitives from the sanctity of software misses the distributed nature of the DPIP. India’s Aadhaar is unique in its decentralized architecture and the number of independent verifiers it supports. Decentralization cuts both ways. It means that while standardization and broad industry consensus are prerequisites to a smooth transition, the luxury of time is a privilege that India cannot afford. The danger is not in the early movers but the late ones that continue to create value-added encrypted data that can be decrypted once quantum computers arrive. However, quantum-secure Digital India will not be built on wishful thinking. It will be built on incremental engineering. Hybrid deployments of cryptography that allow legacy systems to continue functioning while new algorithms are tested, certified, deployed, and optimized with hardware acceleration, where necessary, along with crypto-agility as a procurement qualification, and a testing ecosystem that prioritizes scale will define the art of the possible. The roadmap is now visible. All that remains is for it to be recognized as not just an end but a beginning of something much bigger for Digital India.[5] How will a nation that built its identity layer on classical cryptographic devices fare when the practical quantum threat arrives? It will depend on what we do in the next three years. Sources [1] https://www.livemint.com/opinion/online-views/quantum-computing-dpi-aadhaar-digilocker-risk-encryption-digital-public-infrastructure-11776677449385.html https://www.livemint.com/opinion/online-views/quantum-computing-dpi-aadhaar-digilocker-risk-encryption-digital-public-infrastructure-11776677449385.html https://www.livemint.com/opinion/online-views/quantum-computing-dpi-aadhaar-digilocker-risk-encryption-digital-public-infrastructure-11776677449385.html [2] https://www.thehindu.com/news/national/critical-sectors-must-have-quantum-safe-encryption-urges-task-force/article71029610.ece https://www.thehindu.com/news/national/critical-sectors-must-have-quantum-safe-encryption-urges-task-force/article71029610.ece https://www.thehindu.com/news/national/critical-sectors-must-have-quantum-safe-encryption-urges-task-force/article71029610.ece [3] https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards [4] https://qpf.org/india-quantum-safe-ecosystem-report/ https://qpf.org/india-quantum-safe-ecosystem-report/ https://qpf.org/india-quantum-safe-ecosystem-report/ [5] https://www.digit.in/features/general/niti-aayog-on-pqc-as-dpi-shield-at-india-ai-impact-summit-2026-heres-how.html https://www.digit.in/features/general/niti-aayog-on-pqc-as-dpi-shield-at-india-ai-impact-summit-2026-heres-how.html https://www.digit.in/features/general/niti-aayog-on-pqc-as-dpi-shield-at-india-ai-impact-summit-2026-heres-how.html